Gstreamer vulnerabilities
119 vulnerabilities
Known vulnerabilities in Gstreamer products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Gstreamer111 vulnerabilities
- Good Plug Ins6 vulnerabilities
- Plug Ins3 vulnerabilities
- Gst Plugins Good2 vulnerabilities
- Orc1 vulnerabilities
CVE-2021-3498alpinegstreamer+5
EPSS score1.76%
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.CVE-2021-3522alpinegst-plugins-base+30EPSS score5.37%
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.CVE-2021-3497alpinegstreamer+12EPSS score1.22%
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.CVE-2015-0797debiangst-plugins-bad0.10+19EPSS score5.40%
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.CVE-2016-9807debiangst-plugins-good1.0+3EPSS score2.52%
The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted FLIC file.CVE-2016-9810debiangst-plugins-good1.0+3EPSS score2.37%
The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.CVE-2016-9808alpinegst-plugins-good+5EPSS score5.06%
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.CVE-2016-9634alpinegst-plugins-good+10EPSS score8.84%
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter.CVE-2016-9635alpinegst-plugins-good+10EPSS score8.84%
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer.CVE-2016-9811alpinegst-plugins-base1+39EPSS score2.29%
The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.CVE-2016-9809alpinegst-plugins-bad1+11EPSS score2.90%
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.CVE-2016-9636alpinegst-plugins-good+10EPSS score8.33%
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer.CVE-2016-9445debiangst-plugins-bad1.0+3EPSS score4.84%
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.CVE-2016-9447debiangst-plugins-bad0.10+2EPSS score2.84%
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.CVE-2016-9812alpinegst-plugins-bad1+3EPSS score3.54%
The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.CVE-2016-9813alpinegst-plugins-bad1+3EPSS score7.90%
The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.CVE-2016-9446debiangst-plugins-bad1.0+10EPSS score3.60%
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.CVE-2016-10198alpinegst-plugins-good+5EPSS score2.67%
The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.CVE-2016-10199alpinegst-plugins-good+5EPSS score4.77%
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.CVE-2025-2759gstreamergstreamerEPSS score0.14%
GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448.